Court decision · 29 July 2019
Fashion ID GmbH & Co. KG v Verbraucherzentrale NRW
Case C-40/17, ECLI:EU:C:2019:629 · Court of Justice of the European Union
What it means for your code
Embedding a third-party SDK, pixel or social plugin makes you jointly responsible for the data it collects on page load; gate it behind consent.
What happened
An online retailer embedded Facebook's 'Like' button, which transmitted visitors' personal data to Facebook as soon as the page loaded, regardless of whether they clicked it or had a Facebook account.
What was decided
A website operator that embeds a third-party plugin transmitting visitors' data is a joint controller with the plugin provider for the collection and transmission of that data, and must give notice and obtain consent where required for that stage.
The legal test applied
- An operator that embeds a plugin causing collection and transmission of visitors' data jointly determines the purposes and means of those operations
- Joint controllership is limited to the operations the embedder actually co-determines: collection and disclosure by transmission
- The embedder must give notice and obtain consent, where required, for those operations
What would have changed the outcome
- Plugins that load only after the user clicks or consents avoid pre-consent transmission
- What the plugin provider does with the data afterwards is not the embedder's responsibility
Summary and analysis by Lawpatch, checked by an editor against the source. Risk analysis, not legal advice; the law may have moved on since this decision.